APP operation anomaly analysis and detection method, apparatus and device, and medium

Abstract

The invention relates to the technical field of Internet, and discloses an APP operation anomaly analysis and detection method, device and equipment and a medium, and the method comprises the steps: obtaining a burying point request log and a service access request log sent in the operation process of an application program from at least one server; detecting an abnormal sending behavior of the point burying request according to the point burying request log; when the point burying request has the abnormal sending behavior, analyzing a service access request sent by a terminal corresponding to the point burying request, and judging whether the service access request has the abnormal sending behavior or not; and when the service access request has the abnormal sending behavior, locating that a processing flow, corresponding to the service access request, of the application program has defects. Detection and positioning of the hidden BUG of the application program are achieved, and meanwhile detection efficiency and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a method, device, equipment and medium for analyzing and detecting abnormal operation of APP. Background Art

[0002] In the Internet application development process, quality assurance (QA) testing is usually required to verify the functionality and stability of an application before it is released. Although QA testing can find most bugs and notify developers to fix them, it cannot fully cover all potential problems due to the diversity of application operating environments and device differences.

[0003] In the prior art, common BUG detection methods mainly rely on manual testing and static code analysis. However, these methods are often unable to effectively detect BUGs in some special cases, such as dead loops caused by lack of reasonable loop control, crashes caused by premature calls when asynchronously loading data in a weak network environment, and other problems. In response to these BUGs that are difficult to detect through traditional methods, there is an urgent need for an effective anomaly detection mechanism that can monitor the status and behavior of the application in real time during its actual operation, detect abnormal situations, and promptly alarm or handle them. The online BUG detection mechanism in the prior art that uploads crash logs relies heavily on manual analysis and cannot promptly locate the problem of APP operation abnormalities. Summary of the invention

[0004] In view of this, the present invention provides an APP operation anomaly analysis and detection method to solve the technical problems of low efficiency and low accuracy of APP operation anomaly detection in the prior art.

[0005] According to a first aspect of the present invention, a method for analyzing and detecting abnormalities in APP operation is provided, comprising:

[0006] Obtaining, from at least one server, a tracking request log and a service access request log issued during the running of the application;

[0007] Detect abnormal sending behavior of tracking request based on tracking request logs;

[0008] When there is abnormal sending behavior in the tracking request, analyze the service access request sent by the terminal corresponding to the tracking request to determine whether there is abnormal sending behavior in the service access request;

[0009] When there is abnormal sending behavior of a service access request, there is a defect in the processing flow corresponding to the positioning application and the service access request.

[0010] According to a second aspect of the present invention, there is provided an APP operation abnormality analysis and detection device, comprising:

[0011] An acquisition module, used to acquire, from at least one server, a tracking request log and a service access request log issued during the running of an application program;

[0012] The detection module is used to detect abnormal sending behavior of tracking request according to tracking request logs;

[0013] The first detection module is used to analyze the service access request sent by the terminal corresponding to the burying point request when there is abnormal sending behavior of the burying point request, and determine whether there is abnormal sending behavior of the service access request;

[0014] The second detection module is used to locate defects in the processing flow corresponding to the application program and the service access request when there is abnormal sending behavior of the service access request.

[0015] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned APP operation abnormality analysis and detection method when executing the computer program.

[0016] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the above-mentioned APP operation abnormality analysis and detection method is implemented.

[0017] Through the above technical solution, the present invention provides an APP operation abnormality analysis detection method, device, equipment and storage medium. By introducing an abnormality detection mechanism, the stability and reliability of the application can be improved, and user complaints and losses caused by BUGs can be reduced.

[0018] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention and implement it according to the contents of the specification, and to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0020] Figure 1 A schematic diagram of an application scenario of an APP operation abnormality analysis and detection method provided in an embodiment of the present invention is shown;

[0021] Figure 2 A flowchart of an APP operation abnormality analysis and detection method provided in Embodiment 1 of the present invention is shown;

[0022] Figure 3 A schematic diagram of the structure of an APP operation abnormality analysis and detection device provided in an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0023] The specific implementation of the present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present invention can be combined with each other without conflict.

[0024] The APP operation abnormality analysis and detection method provided in the embodiment of the present invention can be applied to Figure 1 In the scenario, multiple terminals running APP access the backend application service through the reverse proxy Nginx. Each APP is provided with a tracking point (tracking point is also called event tracking Event Tracking, which refers to the related technology and implementation process for capturing, processing and sending specific user behaviors or events. Tracking point is a common data collection method. By tracking points in the page of the application, user data corresponding to the page can be obtained). Some deeply hidden program BUGs often require specific application scenarios to be discovered. This requires the use of an APP operation abnormality analysis and detection method provided by the present invention, which is implemented by collecting and analyzing the log data of Nginx (if it is a load sharing situation, there may be multiple Nginxs providing services. At this time, it is necessary to consider collecting log data of multiple servers for aggregation and re-analysis). The tracking point request log and service access request log issued during the operation of the application are obtained from at least one server; according to the tracking point request log, the abnormal sending behavior of the tracking point request is detected; when the tracking point request has abnormal sending behavior, the service access request issued by the terminal corresponding to the tracking point request is analyzed to determine whether the service access request has abnormal sending behavior; when the service access request has abnormal sending behavior, the processing flow corresponding to the positioning application and the service access request is defective. The detection and positioning of hidden BUGs in applications is realized, while the detection efficiency and accuracy are improved. The present invention introduces service access requests (API requests) in combination with analysis. While reducing the interference of network attack noise, it can accurately locate the specific location of the BUG (the specific API interface can be located to the specific code segment), effectively improving the accuracy and efficiency of application defect positioning.

[0025] The present invention is described in detail below through specific embodiments.

[0026] Embodiment 1

[0027] like Figure 2 As shown, a method for analyzing and detecting abnormal operation of an APP provided in an embodiment of the present invention includes:

[0028] Step 201: Obtain, from at least one server, a tracking request log and a service access request log issued during the running of an application program;

[0029] Among them, when a user performs an operation on the app, the user's behavior is reported, such as clicking the registration button, the login button, etc. This behavior data only has basic information. Through Nginx, the request values ​​of the app requesting all interfaces of the server and the buried request can be recorded. The buried request is usually encrypted, and each request needs to collect basic information, such as app version number, channel number, country, mobile phone model, IP, device unique code, etc.

[0030] Step 202: Detect abnormal sending behavior of the tracking request according to the tracking request log;

[0031] Among them, check the number and number of people of a certain behavior (corresponding to a certain tracking request) per unit time, and check the ratio. For example, if the ratio is too large and the IPs are relatively scattered, this means that there is abnormal behavior, that is, the client has abnormal sending behavior of tracking request. However, it cannot be confirmed that it is a program BUG at this time. In order to improve the detection accuracy, it is necessary to further analyze the API request log in the embodiment of the present invention.

[0032] Step 203: When the tracking request has abnormal sending behavior, analyze the service access request sent by the terminal corresponding to the tracking request to determine whether the service access request has abnormal sending behavior;

[0033] This step is combined with API data or crash logs for analysis. If the behavior has a corresponding API request, check whether the API data has the same abnormal behavior during this period. If so, it is very likely that the app is abnormal. If the behavior does not have a corresponding API request, analyze the crash log (crash log, when the client has an abnormality, it is written to the client locally, and then uploaded to the server when it is started next time). Similar crashes occur on many models, which means that the app has abnormal logic, such as an infinite loop.

[0034] Step 204: When there is an abnormal sending behavior in the service access request, there is a defect in the processing flow corresponding to the positioning application and the service access request.

[0035] After step 204, the developer can be informed in time, so an alarm message indicating that the application has defects can be sent, wherein the alarm message carries the application name and the service access request name.

[0036] The first embodiment of the present invention provides an APP operation abnormality analysis and detection method, which obtains the tracking request log and service access request log issued during the operation of the application from at least one server; detects the abnormal sending behavior of the tracking request according to the tracking request log; when the tracking request has abnormal sending behavior, analyzes the service access request issued by the terminal corresponding to the tracking request to determine whether the service access request has abnormal sending behavior; when the service access request has abnormal sending behavior, locates the defect in the processing flow corresponding to the application and the service access request. The detection and location of hidden BUGs of the application are realized, and the detection efficiency and accuracy are improved at the same time.

[0037] Based on the method provided in the first embodiment of the present invention, a mechanism for discovering hidden bugs is implemented. For example, in certain scenarios, the client may appear in an infinite loop and send a large number of tracking requests and API requests. Another problem is that when the client uploads a picture to the object storage, it needs to obtain an authorization code. The authorization codes given by the server to different users have the same expiration time. The APP client has written a timer. When the authorization code expires, it will request the server. Because the expiration time is set the same, many clients will request at the same time, causing high pressure on the server and sending a large number of tracking requests and API requests.

[0038] Embodiment 2

[0039] In the first embodiment of the present invention, the analysis interval for log behavior is often fixed, or the time segment selected by sampling, which makes it easy to miss many time points of abnormal behavior. Therefore, the second embodiment of the present invention proposes to use a sliding window to improve the detection accuracy. Accordingly,

[0040] Step 201 specifically includes obtaining, based on a sliding time window, from at least one server a tracking point request log and a service access request log corresponding to the recording time and the time window range, wherein the sliding time window size and step size are both preset values.

[0041] Step 202 specifically includes:

[0042] Step 202-1: In each time window, aggregate and count the tracking request logs and calculate the request index data;

[0043] Among them, the request indicator data includes the number of requests, the number of independent users, and the number of IPs;

[0044] Step 202-2, calculating the average number of user requests or the average number of IP requests;

[0045] Step 202-3: When the average number of user requests or the average number of IP requests is greater than the preset tracking point request number threshold, it is determined that the tracking point request has abnormal behavior.

[0046] When there is an abnormal sending behavior in the tracking request, it is necessary to verify whether there is also an abnormality in the API request within the corresponding time range. Accordingly, step 203 specifically includes:

[0047] Step 203-1: Obtain a service access request log corresponding to the application from at least one server according to the time window range of the tracking request;

[0048] Step 203-2: aggregate and count the service access requests and calculate request index data, wherein the request index data includes the number of requests, the number of independent users, and the number of IP addresses;

[0049] Step 203-3, calculating the average number of service access requests per user or the average number of service access requests per IP;

[0050] Step 203-4: When the average number of service access requests by users or the average number of service access requests by IPs is greater than a preset threshold value of the number of service access requests, it is determined that the service access request has abnormal sending behavior.

[0051] Embodiment 3

[0052] Since the triggering frequencies of different burying point requests are different, some burying point requests have a higher request frequency. If the same request number threshold is used for burying point requests with a lower request frequency, the detection accuracy will be reduced. Therefore, in the third embodiment of the present invention, the sliding window size and the request number threshold are dynamically set according to the usage frequency of different burying point requests, which can effectively improve the detection accuracy, as follows:

[0053] According to the usage frequency of different tracking point requests, the sliding time window size corresponding to the different tracking point requests is set, where the sliding time window size is proportional to the usage frequency.

[0054] According to the usage frequency of different burying point requests, a preset burying point request number threshold corresponding to the different burying point requests is set, wherein the preset burying point request number threshold is proportional to the usage frequency.

[0055] Further, as Figure 2 The specific implementation of the method, the embodiment of the present invention provides an APP operation abnormality analysis and detection device, such as Figure 3 As shown, the device comprises:

[0056] An acquisition module 310 is used to acquire, from at least one server, a tracking request log and a service access request log issued during the running of an application program;

[0057] The detection module 320 is used to detect abnormal sending behavior of the tracking request according to the tracking request log;

[0058] The first detection module 330 is used to analyze the service access request sent by the terminal corresponding to the burying request when there is abnormal sending behavior of the burying request, and determine whether there is abnormal sending behavior of the service access request;

[0059] The second detection module 340 is used to locate defects in the processing flow corresponding to the application program and the service access request when there is abnormal sending behavior of the service access request.

[0060] In an embodiment of the present invention, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, an APP operation abnormality analysis and detection method is implemented, including:

[0061] Obtaining, from at least one server, a tracking request log and a service access request log issued during the running of the application;

[0062] Detect abnormal sending behavior of tracking request based on tracking request logs;

[0063] When there is abnormal sending behavior in the tracking request, analyze the service access request sent by the terminal corresponding to the tracking request to determine whether there is abnormal sending behavior in the service access request;

[0064] When there is abnormal sending behavior of a service access request, there is a defect in the processing flow corresponding to the positioning application and the service access request.

[0065] In an embodiment of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0066] Obtaining, from at least one server, a tracking request log and a service access request log issued during the running of the application;

[0067] Detect abnormal sending behavior of tracking request based on tracking request logs;

[0068] When there is abnormal sending behavior in the tracking request, analyze the service access request sent by the terminal corresponding to the tracking request to determine whether there is abnormal sending behavior in the service access request;

[0069] When there is abnormal sending behavior of a service access request, there is a defect in the processing flow corresponding to the positioning application and the service access request.

[0070] It should be noted that, in the above embodiments, only the application of APP is explained. In actual application scenarios, as long as there is interaction between the client and the server, the technical solution of the present invention is applicable. For the functions or steps that can be implemented by the computer-readable storage medium or computer device, please refer to the aforementioned method embodiments. To avoid repetition, they will not be described one by one here.

[0071] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0072] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0073] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for analyzing and detecting abnormal operation of APP, characterized in that: include: Obtaining, from at least one server, a tracking request log and a service access request log issued during the running of the application; Detect abnormal sending behavior of tracking request based on tracking request logs; When the tracking request has abnormal sending behavior, analyzing the service access request sent by the terminal corresponding to the tracking request to determine whether the service access request has abnormal sending behavior; When there is abnormal sending behavior of the service access request, there is a defect in the processing flow corresponding to the application program and the service access request.

2. The APP operation abnormality analysis and detection method according to claim 1 is characterized in that: The step of obtaining, from at least one server, a tracking request log and a service access request log issued during the running of the application program includes: Based on the sliding time window, the point request log and service access request log corresponding to the recording time and the time window range are obtained from at least one server, wherein the sliding time window size and step size are both preset values.

3. According to the APP operation abnormality analysis and detection method of claim 2, the step of detecting the abnormal sending behavior of the tracking request according to the tracking request log comprises: In each time window, aggregate and count the tracking point request logs to calculate the request index data, where the request index data includes the number of requests, the number of independent users, and the number of IP addresses; Calculate the average number of requests by user or IP; When the average number of user requests or the average number of IP requests is greater than the preset tracking point request number threshold, it is determined that the tracking point request has abnormal behavior.

4. The APP operation abnormality analysis and detection method according to claim 2 is characterized in that: The step of analyzing the service access request sent by the terminal corresponding to the tracking request to determine whether the service access request has abnormal sending behavior includes: Obtaining, from at least one server, a service access request log corresponding to the application program according to a time window range of the tracking request; Aggregate and count service access requests and calculate request indicator data, where the request indicator data includes the number of requests, the number of independent users, and the number of IP addresses; Calculate the average number of service access requests by user or IP; When the average number of service access requests of users or the average number of service access requests of IPs is greater than a preset service access request number threshold, it is determined that the service access request has abnormal sending behavior.

5. The APP operation abnormality analysis and detection method according to claim 2 is characterized in that: According to the usage frequency of different tracking point requests, the sliding time window size corresponding to the different tracking point requests is set, where the sliding time window size is proportional to the usage frequency.

6. The APP operation abnormality analysis and detection method according to claim 3 is characterized in that: According to the usage frequency of different burying point requests, a preset burying point request number threshold corresponding to the different burying point requests is set, wherein the preset burying point request number threshold is proportional to the usage frequency.

7. The APP operation abnormality analysis and detection method according to claim 1 is characterized in that: After the step of locating a defect in the processing flow corresponding to the application program and the service access request when the service access request has abnormal sending behavior, the method includes: Send an alarm message indicating that an application has a defect, wherein the alarm message carries an application name and a service access request name.

8. An APP operation abnormality analysis and detection device, characterized in that: include: An acquisition module, used to acquire, from at least one server, a tracking request log and a service access request log issued during the running of an application program; The detection module is used to detect abnormal sending behavior of tracking request according to tracking request logs; The first detection module is used to analyze the service access request sent by the terminal corresponding to the burying point request when the burying point request has abnormal sending behavior, and determine whether the service access request has abnormal sending behavior; The second detection module is used to locate defects in the processing flow corresponding to the application program and the service access request when there is abnormal sending behavior in the service access request.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the APP operation abnormality analysis and detection method as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for analyzing and detecting APP operation abnormalities as described in any one of claims 1 to 7 is implemented.

Images